From 66068533324cf00f04048401b1a70e4c64c12052 Mon Sep 17 00:00:00 2001 From: Eric Wagoner Date: Sat, 17 Oct 2026 20:12:49 -0400 Subject: [PATCH] A seat link's token is cut from an error report and its breadcrumbs before it goes to Sentry, since the history breadcrumb for taking the link out of the address bar still names it Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_0141G6xqLeNRYEtviLWSB5Up --- packages/web/src/main.ts | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/packages/web/src/main.ts b/packages/web/src/main.ts index aa863a2..547d916 100644 --- a/packages/web/src/main.ts +++ b/packages/web/src/main.ts @@ -2,6 +2,13 @@ import { mount } from "svelte"; import Announcement from "./Announcement.svelte"; import * as Sentry from "@sentry/browser"; +/** A seat link carries its token in the fragment (#seat=.), and + * the history breadcrumb for taking it out of the address bar still names + * it, so it is cut from every report before one leaves the browser. */ +function scrub(text: string): string { + return text.replace(/(#seat=)[^&#\s"']*/g, "$1…"); +} + // Errors only — no tracing, no replay. Without a DSN baked at build time // (VITE_SENTRY_DSN in .env.production) this is entirely inert. if (import.meta.env.VITE_SENTRY_DSN) { @@ -13,6 +20,8 @@ if (import.meta.env.VITE_SENTRY_DSN) { // Extensions run their own scripts in the page, and their failures are not ours. denyUrls: [/^iabjs:\/\//, /^(chrome|moz|safari(-web)?)-extension:\/\//], ignoreErrors: ["Java object is gone"], + beforeSend: (event) => JSON.parse(scrub(JSON.stringify(event))), + beforeBreadcrumb: (crumb) => JSON.parse(scrub(JSON.stringify(crumb))), }); }